CVE catalog

CVE-2023-47268

In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.

[CVE catalog]

Severity
Medium · CVSS 5.3
Published
Source
[NVD] · [CVE record]
EPSS
0.72% · Oct 25, 2026

In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is sliced and G-code exported.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianslic3r-prusasid2.9.6+dfsg-2unknown
Debianslic3r-prusaforky2.9.6+dfsg-2unknown
Debianslic3r-prusatrixie2.9.2+dfsg-1unknown
Debianslic3r-prusabookworm2.5.0+dfsg-4unknown
Cpeslic3r-prusaNot reportedNot reportedvulnerable
CpeprusaslicerNot reportedNot reportedunknown
Ubuntuslic3r-prusa18.041.37.0+dfsg-1.1vulnerable
Ubuntuslic3r-prusa18.041.37.0+dfsg-1.1build1vulnerable
Ubuntuslic3r-prusa18.041.38.0+dfsg-1vulnerable
Ubuntuslic3r-prusa18.041.39.0+dfsg-1vulnerable
Ubuntuslic3r-prusa18.041.39.1+dfsg-3vulnerable
Ubuntuslic3r-prusa20.041.39.2+dfsg-1build3vulnerable
Ubuntuslic3r-prusa20.041.39.2+dfsg-1build4vulnerable
Ubuntuslic3r-prusa20.042.1.1+dfsg-1vulnerable
Ubuntuslic3r-prusa20.042.1.1+dfsg-2vulnerable
Ubuntuslic3r-prusa20.042.1.1+dfsg-2build1vulnerable
Ubuntuslic3r-prusa20.042.1.1+dfsg-2build2vulnerable
Ubuntuslic3r-prusa20.042.1.1+dfsg-2ubuntu1vulnerable
Ubuntuslic3r-prusa22.042.3.1+dfsg-1vulnerable
Ubuntuslic3r-prusa22.042.4.0+dfsg-1vulnerable
Ubuntuslic3r-prusa22.042.4.0+dfsg-2vulnerable
Ubuntuslic3r-prusa24.042.5.2+dfsg-1vulnerable
Ubuntuslic3r-prusa24.042.7.2+dfsg-1build1vulnerable
Ubuntuslic3r-prusa24.042.7.2+dfsg-1build2vulnerable
Ubuntuslic3r-prusa26.102.9.4+dfsg-4vulnerable
Ubuntuslic3r-prusa26.102.9.6+dfsg-1vulnerable
Ubuntuslic3r-prusa26.102.9.6+dfsg-1build1vulnerable
Ubuntuslic3r-prusa26.042.9.2+dfsg-1vulnerable
Ubuntuslic3r-prusa26.042.9.4+dfsg-2ubuntu1vulnerable
Ubuntuslic3r-prusa26.042.9.4+dfsg-4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianslic3r-prusasourcesid(unfixed)not yet assignedNot reportedNot reported
Debianslic3r-prusasourceforky(unfixed)not yet assignedNot reportedNot reported
Debianslic3r-prusasourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianslic3r-prusasourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [prusa-slicer]Affected

    Source package: [slic3r-prusa]

    Details (2)

    • 2.5.0+dfsg-4 · amd64 · bookworm

      Affected

      nvd · slic3r-prusa · debian · bookworm; nvd · slic3r-prusa · debian · 12

    • 2.5.0+dfsg-4 · arm64 · bookworm

      Affected

      nvd · slic3r-prusa · debian · bookworm; nvd · slic3r-prusa · debian · 12

  • [slic3r-prusa]Affected
    Details (2)

    • 2.5.0+dfsg-4 · all · bookworm

      Affected

      nvd · slic3r-prusa · debian · bookworm; nvd · slic3r-prusa · debian · 12

    • 2.5.0+dfsg-4 · all · bookworm

      Affected

      nvd · slic3r-prusa · debian · bookworm; nvd · slic3r-prusa · debian · 12

[Debian 13 (Trixie)]

  • [prusa-slicer]Affected

    Source package: [slic3r-prusa]

    Details (2)

    • 2.9.2+dfsg-1 · amd64 · trixie

      Affected

      nvd · slic3r-prusa · debian · 13

    • 2.9.2+dfsg-1 · arm64 · trixie

      Affected

      nvd · slic3r-prusa · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]